PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Jul 5, 2019 | Jun 26, 2019 |
| Centos_linux | — | Upgrade postgresql-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-debugsourceUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresqlUpgrade postgresql-server-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-plpython3-debuginfo | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | — | Upgrade postgresql11-serverUpgrade postgresql10-server | Jun 27, 2019 | Jun 27, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jun 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-plperlUpgrade postgresql-plpythonUpgrade postgresql-contribUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-server | Aug 28, 2019 | Jun 26, 2019 |
| Oracle_linux | — | Upgrade rh-postgresql10-postgresql-develUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-libsUpgrade postgresql-staticUpgrade rh-postgresql10-postgresql-syspathsUpgrade rh-postgresql10-postgresql-docsUpgrade postgresql-upgrade-develUpgrade rh-postgresql10-postgresqlUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade postgresql-testUpgrade postgresql-contribUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-upgradeUpgrade rh-postgresql10-postgresql-plpythonUpgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-staticUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.4 | Jun 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | Upgrade postgresql-plperl-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-test-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade postgresql | Sep 9, 2020 | Jun 26, 2019 |
| Suse | — | Upgrade postgresql12Upgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql10-docsUpgrade postgresql10-pltclUpgrade postgresql10-develUpgrade postgresql-contribUpgrade postgresql-serverUpgrade libecpg6Upgrade postgresql-plpythonUpgrade postgresql12-plperlUpgrade postgresql10Upgrade postgresql-server-develUpgrade libpq5Upgrade postgresql10-plpythonUpgrade postgresql10-contribUpgrade python3-psycopg2Upgrade postgresql12-docsUpgrade postgresql12-plpythonUpgrade libpq5-32bitUpgrade postgresqlUpgrade postgresql10-serverUpgrade postgresql12-server-develUpgrade postgresql10-testUpgrade postgresql12-contribUpgrade postgresql10-plperlUpgrade postgresql12-serverUpgrade libecpg6-32bitUpgrade postgresql12-pltclUpgrade postgresql12-develUpgrade postgresql-docs | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Jun 21, 2019 | Jun 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub